CVE-2014-9033
MEDIUM
6.8
CVSS 2.0
Description
Cross-site request forgery (CSRF) vulnerability in wp-login.php in WordPress 3.7.4, 3.8.4, 3.9.2, and 4.0 allows remote attackers to hijack the authentication of arbitrary users for requests that reset passwords.
Affected WordPress components
-
WordPress coreVersion 3.8.4; Version 3.7.4; Version 3.9.2; Version 4.0
A confirmed match is backed by the plugin or theme slug. A possible match is based on the product name only and should be verified.
Affected products and versions
- n/a n/a — Versions not specified
- wordpress wordpress — Version 3.7.4
- wordpress wordpress — Version 3.8.4
- wordpress wordpress — Version 3.9.2
- wordpress wordpress — Version 4.0
References
- advisories.mageia.org http://advisories.mageia.org/MGASA-2014-0493.html
- core.trac.wordpress.org http://core.trac.wordpress.org/changeset/30418 Vendor Advisory
- openwall.com http://openwall.com/lists/oss-security/2014/11/25/12
- www.debian.org http://www.debian.org/security/2014/dsa-3085
- www.mandriva.com http://www.mandriva.com/security/advisories?name=MDVSA-2014:233
- www.securitytracker.com http://www.securitytracker.com/id/1031243
- wordpress.org https://wordpress.org/news/2014/11/wordpress-4-0-1/ Patch, Vendor Advisory
- nvd.nist.gov Official NVD record